Micollab client deployment issue 1

[Nasom]

Hi everyone,

I am facing an issue with a new installation. I have configured a micollab and MIVB in LAN zone and one MBG in DMZ zone, without firewall rules among them. All the required configuration is completed (cluster, connectors, db sharing, …etc). The Certificate is from Let's Encrypt Authority. My problem is when I add a user the system creates a SIP profile in MBG but doesn’t create a SIP user name in MiCollab Client Deployment and the following message appears: ((Errors occurred for this User. Would you like to delete it? MBG is configured in Users And Services but not here. Please use 'Sync-data' action on 'Manage'-page to fix this!))
Now when I try to sync, the following error appears: Failed to synchronize 1 User: User name (extension number): Error while trying to get data from MBG: 'Error: MSL-Rest returned status 403: Forbidden' Error while trying to get data from MBG: 'Error: MSL-Rest returned status 403: Forbidden'

After that, I connected to Mbg via ssh and I started searching for logs and I found the following in this directory: /var/log/mslrest/current

[Thu Feb 6 10:05:03 2020] [info] New request to /mslrest/mbg/v1/icps/(ip micollab) /
[Thu Feb 6 10:05:03 2020] [info] In authenticate
[Thu Feb 6 10:05:03 2020] [info] good signature MVrAlIuPiWaZ3xzxOyyF7lp/UyU=
[Thu Feb 6 10:05:03 2020] [info] forbidden: Access denied

In the end, after all the above, when I generate a password from ‘user edit’ interface, the system changes its profile from teleworker (which I create) to default in MiCollab Client Deployment interface

Do you have any ideas ?

Version MiCollab 9.1.2.4-01
Mitel Standard Linux 11.0.63.0
MiVoice Border Gateway 11.0.0.287

 

[AlphaMann]

I would say by the Sync-data error that your Client Deployment services configuration is not complete.
In MiCollab Client Deployment under Configuration, Connection to MBG's make sure that the Token is verified.
Then on Deployment Profiles make sure that the profile is correctly setup.

 

[Nasom]

We have already checked the configuration in Client deployment services.
We have authenticated the connection between MBG and Micollab multiple times.
Token is verified and Profiles are configured properly.

Thank you AlphaMann for the responce.

 

[Billz66]

regarding this "My problem is when I add a user"

how are you creating the user ?
do you have a template that assigns all the appropriate settings including a SIP password that is complex

We have been doing this for a while and there was a software release where the SIP Password requirements were made more complex
- the way we got it working was to adjust the SIP password to be used for the MBG SIP extension to be more complex
once that was done it started working again

Another thing to check is are the web services enabled ( and started) on the remote MBG- looks like the MBg's arent communicating



If I never did anything I'd never done before , I'd never do anything.....

 

[brewski6666]

have the same issue here, opened a ticket with Mitel support, they reviewed the configuration for two hours, they didn't find anything wrong, but they still unable to explain why the MBG is sending the ''403 forbedden''

 

[jpruder]

Is this a multi device and is it in the groups? If a user has a sip softphone, I let that be the deployment source and leave the client value to do not deploy

 

[Nasom]

 

[Nasom]

Hello all and thank you for replying,
I have attached pictures of micollab configuration for anyone who can find some time to check it out.
This is really frustrating and what brewski6666 posted pretty much destroyed our expectations.
Here are the logs as well from MBG when we try to sync a user:
[root@mbg mslrest]# tail -f /var/log/mslrest/current
@400000005e41662c2bebfee4 [Mon Feb 10 16:18:10 2020] [info]
@400000005e41662c2bedcfbc [Mon Feb 10 16:18:10 2020] [info] New request to /mslrest/mbg/v1/icps/10.0.15.10/
@400000005e41662c2befe6e4 [Mon Feb 10 16:18:10 2020] [info] In authenticate
@400000005e41662c2c3786d4 [Mon Feb 10 16:18:10 2020] [info] good signature oUXgVkT5jTm3GzTwUo3Xs/EYnH4=
@400000005e41662c2c63c6f4 [Mon Feb 10 16:18:10 2020] [info] forbidden: Access denied
@400000005e41662d1c7b4c44 [Mon Feb 10 16:18:11 2020] [info]
@400000005e41662d1c7c7524 [Mon Feb 10 16:18:11 2020] [info] New request to /mslrest/mbg/v1/devices/sip/icpside_username/5*530/
@400000005e41662d1c7e9bec [Mon Feb 10 16:18:11 2020] [info] In authenticate
@400000005e41662d1cb8e9b4 [Mon Feb 10 16:18:11 2020] [error] bad signature '4H6WsrPDZ+aFLzg/StXQ24SxKXY='
@400000005e41662d1cb90cdc [Mon Feb 10 16:18:11 2020] [info] unauthorized: Bad signature

 

[brewski6666]

Hello Nasom,
got update from Mitel support: there was a bu with MBG (version: 11.0.0.287), if you are using this same release, your issue is related to this bug.
to fixe the issue, they opened Putty and execute few commands as a work around. the issue (403 forbedden)is now gone.
if you have the same MBG release, you probably need to upgrade or call Mitel support to get the fixe.

 

[Nasom]

Hello brewski6666 and thank you for the answer.
Cold you tell me which MSL version you have. We have the same MBG Version so we will look into it.
By any chance to you have the Putty commands?

Thank you for telling us about the bug, now we know its not us and we can rest a bit.

 

[brewski6666]

I'll be back in the office by tomorrow, I'll update with the MSL version and the putty commands.

 

[brewski6666]

the MSL version for my MBG is 11.0, Sorry for the putty commands, I thought I had saved a screenshot, but it is not.

 

[Nasom]

It doesn't matter that you dont have the commands. You already helped us a lot brewski6666 thank you so much.
The problem still exists but we will find a solution soon.
I will update with the results if there are any.

 

[sarond]

Did anyone find a solution to this? I am having the same issue.
MiCollab Deployment test fails "From public internet" with a 403 Forbidden error.
Also new users don't get the MBG settings in their deployment profile.

If it is a bug with MBG version 11.0.0.287 is there a KMS article on it? I can't find one.

Going by the latest release notes on 11.0.0.294 it could be a Webservices Permissions problem. Does anyone know what commands I would need to fix this, I'm assuming I need to CHMOD or CHOWN a directory.

Versions
MiCollab: 9.1.2.102-01
MBG: 11.0.0.287

 

[techymitel]

MBG permissions issue detailed in SO4934

https://mitel.custhelp.com/app/answers/answer_view/a_id/1013500/672706380

You can also manually configure a set side sip password on the MBG before deploying.

 

[TCSI17]

I have this exact same problem and I've contacted Mitel Support already on it. They confirmed its a bug in current MiCollab and it will be fixed in next release of MiCollab.

It seems to be causing more issues than just the Client Deployment as I have seen the MiCollab Mobile MBG SIP device disappear from Teleworker when the password is changed in MiCollab. You have to go in and re-add it as Teleworker.
There is a workaround that you need to do to get the users importing properly into Client Deployment. One thing you will notice is when you go and pull the list of importable users from MBG (from within Client Deployment), there is no MBG username that is populated. Once you do the workaround that Mitel provides (its easy) then it will import properly.

 

[sarond]

Thanks guys, my main issue with the 403 forbidden was an incorrectly configure web proxy on the MBG.

 

[G R D]

The workaround I was given was to create a new deployment profile that uses the local MBG (the one on the MiCollab server) then swap it to the proper on before you send the deployment email. Unfortunately this also doesn't work. The MBG user name is still blank. Waiting to hear back from Mitel on this. They've been very helpful so far but it is frustrating when something that works just stops working.

 

[Nneemesis]

I think that the problem is rigth here, you have to check that the web services are enabled and the token between MBG's are accepted.
One more thing there is a diagnostics tab under client deploy, wich are your results if you run a diagnostic with the profile you are deploying the users???
In MiCollab Client Deployment under Configuration, Connection to MBG's make sure that the Token is verified
Another thing to check is are the web services enabled ( and started) on the remote MBG- looks like the MBg's arent communicating

Good Luck

 

[Nasom]

If I remember correctly Mitel told us this was a bug on a previous version of Micollab. It was fixed on a newer version.